This vulnerability in Fosowl agenticSeek 0.1.0 involves code injection through the PyInterpreter.execute function located in sources/tools/PyInterpreter.py within the query Endpoint component. The flaw allows an unauthenticated remote attacker to inject and execute arbitrary code. The vulnerability has been publicly disclosed, but no vendor response or patch has been issued. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system without authentication. This can lead to unauthorized control or manipulation of the affected Fosowl agenticSeek instance. However, the impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploits have been reported in the wild.

No official patch or remediation is currently available, and the vendor has not responded to the disclosure. Users should monitor the vendor's channels for any future updates or fixes. Until a patch is released, consider restricting network access to the affected service to trusted users only and apply any general security controls that limit exposure to untrusted networks.